An anonymous reader writes: The Necurs botnet has been harnessed to fling a new strain of ransomware dubbed “Jaff”. Jaff spreads in a similar way to the infamous file-encrypting malware Locky and even uses the same payment site template, but is nonetheless a different monster. Attached to dangerous emails is an infectious PDF containing an embedded DOCM file with a malicious macro script. This script will then download and execute the Jaff ransomware. Locky — like Jaff — also used the Necurs botnet and a booby-trapped PDF, security firm Malwarebytes notes. “This is where the comparison ends, since the code base is different as well as the ransom itself, ” said Jerome Segura, a security researcher at Malwarebytes. “Jaff asks for an astounding 2 BTC, which is about $3, 700 at the time of writing.” Proofpoint reckons Jaff may be the work of the same cybercriminals behind Locky, Dridex and Bart (other nasty malware) but this remains unconfirmed. And Forcepoint Security Labs reports that malicious emails carrying Jaff are being cranked out at a rate of 5 million an hour on Thursday, or 13 million in total at the time it wrote up a blog post about the new threat. Read more of this story at Slashdot.

This month’s posts:

About Ken May

Kenneth May is a certified cybersecurity professional. He and his team offer services such as Advanced Vulnerability Assessments, Network Penetration Testing, Web Application Penetration Testing, and a wide array of compliance services covering HIPAA, PCI, and the various NIST & DOD requirements. Ken is a Community mentor for SANS, the largest Cybersecurity certification preparation company in the world, and carries both the GSEC and GPEN (Certified Ethical Hacker and Penetration Tester) certifications. He has recently been accepted into the FBI’s Infragard program, as a recognized protector of critical national infrastructure. This program gives him deep access to information and resources to protect his clients.